1. Retention Schedule
- Account and profile — for the life of the account plus 30 days after closure.
- KYC and EDD records — 5 years after account closure (AML obligation).
- Financial ledger and blockchain records — retained indefinitely for regulatory, tax, and reconciliation purposes.
- Gameplay logs and seeds — 24 months (revealed seeds published for verification).
- Security and audit logs — 5 years.
- Support tickets and correspondence — 24 months.
- Marketing preferences — until you unsubscribe or your account is closed.
- Backups — encrypted, retained for 30 days on rolling schedule; deletions replicated on the next backup cycle.
2. Deletion
Data past its retention period is deleted or irreversibly anonymised on a rolling schedule. Requests for erasure are handled subject to overriding legal retention obligations (particularly AML). See Privacy Policy.
3. Security Controls
- TLS 1.2+ in transit, AES-256 at rest.
- Argon2id or bcrypt for password hashing.
- Hardware-backed key custody for treasury operations; multi-signature for warm and cold tiers.
- Row-level security in the database; principle of least privilege.
- MFA enforced for all privileged accounts; hardware keys for treasury and admin roles.
- Immutable audit logging with tamper-evident storage.
- Continuous dependency scanning; SAST and DAST in the CI/CD pipeline.
- 24/7 monitoring, alerting, and on-call incident response.
- Segregation of environments; production access via bastion with session recording.
4. Sub-Processors
Cloud hosting, database, object storage, email delivery, KYC vendors, sanctions screening, blockchain analytics, fraud detection, and customer support providers are engaged under Data Processing Agreements that impose equivalent obligations.
5. Incident Response
We maintain a documented incident-response plan. Confirmed personal-data breaches that are likely to result in risk to individuals are notified to the competent supervisory authority within 72 hours where required, and to affected individuals without undue delay where a high risk exists.
6. Vulnerability Disclosure
Report security issues to security@tethbet.com. We do not pursue researchers acting in good faith under our responsible-disclosure guidelines and offer bounties for qualifying reports.
7. Business Continuity and Disaster Recovery
We maintain documented BCP/DR plans, tested at least annually, with defined RPO and RTO targets appropriate to the criticality of each system.
8. Your Rights
Requests to exercise data rights should be sent to privacy@tethbet.com. See Privacy Policy.
9. Contact
Security: security@tethbet.com. DPO: dpo@tethbet.com.